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We discuss the 'no-clicking' event, which is harmful for legitimate users in Bennett-Brassard 1984 
quantum key distribution: We describe an attack where no-clicking events are utilized in the same 
way as double-clicking events are utilized in the quantum Trojan-pony attack. We discuss how to 
deal with the no-clicking events. We discuss how to estimate the security of the protocol against 
the proposed attack by using a formula involved with the fraction of adversarial removals of events. 
PACS: 03.67.Dd 
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I. INTRODUCTION 



Information processing with quantum systems, e.g., 
quantum cryptography [l|, quantum computation 

p] , and quantum metrologies [5!,|6| , enables us to do some 
tasks that we cannot do with its classical counterparts. 
In addition to the practical importance, this fact has big 
theoretical implications. 

The Bennett-Brassard 1984 (BB84) quantum key dis- 
tribution (QKD) protocol [1| is one of the most promising 
quantum information processing techonology. Security of 
the BB84 protocol was studied in the ideal case where the 
source, the channel, and the detector are all perfect 0- 
However, no actual device is perfect. Later, security of 
the BB84 protocol in the case where the channel was im- 
perfect while the source and the detector were perfect 
was given [1, i, [S, [H, [ll • 

An imperfect source gives rise to the problem of 
photon-number-splitting (PNS) attack [ij, [3, Si- 
Methods to deal with the problem are given in Refs. [Iq 
and [l3l- However, the problem of the PNS attack be- 
comes more serious when the imperfect source is com- 
bined with loss [U, 111, llBl- Thus, a practicable long- 
distance BB84 QKD system, which usually has high loss, 
is not secure against the PNS attack. The decoy method 
[11 [H, [1^ and the SARG04 protocol [2l| are two inde- 
pendent ways to overcome the problem of the PNS attack 
combined with high loss. The long-distance BB84 proto- 
col supplemented with a decoy can be secure as long as 
detectors are perfect. 

A remaining step is, therefore, to resolve problems due 
to imperfect detectors. Imperfect detectors give rise to 
undesired events, e.g. double-clicking and no-clicking. A 
no-clicking event can be easily overlooked because they 
are not exposed. However, no-clicking events can give 
rise to a post-selection effect as in the case of detection- 
loopholes [l^l for Bell's inequality violation. 

The purpose of this paper is to discuss problems due to 
no-clicking in the BB84 protocol. Our presentation is in 
the following order: In Section II, we describe why the no- 
clicking event is problematic. In Section HI, we discuss 
how to deal with the no-clicking event. In Section IV, we 
discuss how to estimate the security of the protocol. In 
Section V, we conclude. 



II. PROBLEMATIC NO-CLICKING EVENT 

Let us define terminology. A loss- event is the case 
where no detector of Bob clicks even when a quantum 
carrier with a bit of key, e.g., a pulse of photons, was sent 
by Alice. Here, Alice and Bob are the legitimate sender 
and receiver of quantum carriers, respectively. The loss- 
event may be either due to a channel-loss event in which 
the quantum carrier was lost in the channel or due to a 
no- clicking event in which the detector did not click for 
certain reasons, e.g., it failed to click because of imper- 
fection. That is, either channel-loss or no-clicking can 
give rise to a loss-event. However, channel-loss and no- 
clicking events cannot be discriminated by Alice and Bob. 

The possibility that no-clicking event was problematic 
was first noted in Ref. [l^ ■ In order to deal with the no- 
clicking event, they "conservatively" assume that "Eve 
has control ... on rjB (detection efficiency),..." (Here Eve 
denotes an eavesdropper.) What they mean is the fol- 
lowing: As mentioned above, a loss event may be due to 
either a channel- loss event or a no-clicking event. What 
they assume is that detectors are perfect; thus, all loss 
events are due to channel losses. Here channel losses are 
due to Eve's action. 

However, imperfect detectors give rise to post-selection 
effects that may be harmful for Alice and Bob. This is 
implied by a few papers. The post-selection effect by 
imperfect detectors is mentioned in Section XIII of Ref. 
[17| . Other interesting post-selection effects are discussed 
in Ref. [H and Refs. and [H. The Referencs H 
and [1^ overlap with our paper, but are different, as will 
be discussed in Section V. How to coherently deal with 
all post-selection effects due to the no-clicking event, in- 
cluding those works [l3, IH, [H, HE], is an open problem. 
In Ref. [l3|, they discuss the problem with detector ef- 
ficiency. They give a formula (Eq. (58) of Ref. [l3|) for 
the key generation rate. However, a fraction '/' of ran- 
dom removal is not provided. Now let us see at how a 
no-clicking event can be problematic in more detail. 

First, let us see why Fred, a friend of Eve in detectors, 
is introduced [iTj . Imperfectness in detector is not some- 
thing that is supposed to be in full control of Alice and 
Bob. It can be that the imperfectness gives rise to sys- 
tematic errors that happen to be useful for Eve. Thus, 
Alice and Bob may consider the worst case in which a 
hypothetical being, Fred, who wants to help his friend 
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Eve has full control of the detector. He can turn the de- 
tector on or off as he wants. Because it is not excluded 
that Fred can get information about the basis of the de- 
tector, he is supposed to know the basis. One might say 
that if a friend of Eve has access to Bob's detector, why 
doesn't the friend read the final plain text of Bob directly 
and sends it to Eve [1^ . That powerful friend can break 
the whole system of Alice and Bob, of course. However, 
the Fred we consider is less powerful than this friend of 
Eve. Fred is confined in a detector, so he cannot observe 
something outside the detector by any means except by 
quantum carriers given to him via a window of the de- 
tector. 

An alliance of Eve and Fred can cheat a careless Al- 
ice and Bob, for even moderate loss, who take no ac- 
count of no-clicking events: Like in the case of the quan- 
tum 'Trojan pony' attack [ITII . Eve performs an opaque 
(intercept-resend) attack [23] in the following way: Eve 
does not know the basis of Alice, of course. However, she 
does a measurement that is randomly picked up between 
Z and X for each photon pulse sent by Alice. Here, Z 
and X are measurements in the z basis, {|0), |1)} and in 
the X basis, {|0),|1)}, respectively. Here, |0) and |1) are 
two orthogonal states; (0|1) = 0, |0) = (l/y2)(|0) -I- 
and |1) = (1/V2)(|0) - When the outcome of the 
Z measurement is (1), Eve prepares multiple copies 
of |0) (|1)), namely |0)®^ Then, she forwards 

them to Bob. In the same way, when the outcome of the 
X measurement is (1), Eve prepares multiple copies 
of |0) (|T)), namely |0)®^ Then, she forwards 

them to Bob. The strategy of Fred is the following: He 
splits the state \k)®^ (fc = 0,l,0,l) to \k)®^-^ and |fc). 
When iV — 1 is large enough, Fred can identify the state 
with high reliability. If the basis of the state that Eve 
has forwarded is the same as that of the detector, Fred 
gives the remaining state, |fc), to the detector. If differ- 
ent, Fred turns off the switch of the detector. Now let us 
see how Eve can eavesdrop without being detected. Note 
that the only case in which Eve's action can be caught is 
when the basis of Eve and that of Alice and Bob alliance 
do not match; Alice and Bob happen to adopt the same 
basis and Eve happens to adopt the other basis. How- 
ever, in the above attack, whenever a non-matching case 
happens Fred turns off the detector. Therefore, Eve's ac- 
tion is not detected at all even if she performs the above 
attack for every quantum carrier if Alice and Bob simply 
discard no-clicking events. 

The above attack using no-clicking event is in paral- 
lel with the quantum Trojan pony attack In the 
quantum Trojan pony attack, Eve attempts to nullify 
non-matching cases by making Bob's detector double- 
click. If Alice and Bob simply discard the data for a 
double-click event, the quantum Trojan pony attack re- 
duces to an attack using no-clicking event in which Alice 
and Bob discard the data for a no-clicking event. How- 
ever, a double-clicking event can be detected directly. 
Alice and Bob take into account a double-clicking event 
in their estimate of the security [3, ■ A no-clicking 



event can be detected indirectly: When the detector does 
not click when it is supposed to, we say that a no-clicking 
event is detected. We term the attack using a no-clicking 
event as a quantum 'Trojan-dark-pony' attack. An easy 
way to maintain security is for Alice and Bob to regard 
a no-clicking event as an 'error event' that contributes to 
the quantum bit error rate (QBER) [23|. In this case, 
however, loss lower-bounds the QBER. Thus, even for a 
moderate loss, there is no secure protocol even if every- 
thing else is perfect. Thus, this method is not practical. 



III. HOW TO DEAL WITH NO-CLICKING 
EVENTS 

Before we discuss how to maintain security, we have 
to characterize detectors for a no-clicking event. How- 
ever, in order to characterize a detector, we need to find 
a principle governing the behavior of the detector. At 
first look, one might think that it is difficult to find the 
principle governing behavior of detectors for a no-clicking 
event because a no-clicking event is neither a desired nor 
an ideal process. However, this is not the case. 

Proposition I: a no-clicking event can be dealt with by 
using a normal quantum measurement, POM. That is, 
a certain positive- operator is assigned for a no- clicking 
event. 

Proposition! is already adopted in Ref. [2^. How- 
ever, let us describe why Proposition 1 is valid, for those 
who are not convinced. Usually, a quantum detector is 
a 'black-box' that gives rise to macroscopically distinct 
events for microscopic inputs. For example, a photon 
polarization detector gives clicking of a photon detector 
between two photon detectors as an output for an input 
photon. However, although a no-clicking event literally 
does not give a noticeable event, a no-clicking event can 
still be macroscopically distinguished from other events. 
Thus, there is no difficulty in assigning a number, say 0, 
to a no-clicking event, like in the case of other notice- 
able events. With Proposition 1, we can characterize a 
no-clicking event. What we have to do is to identify the 
positive-operator corresponding to a no-clicking event by 
repeated measurements. 

Let us now discuss how to maintain security for a no- 
clicking event. First let us introduce a quantity A, the 
fraction of adversarially removed events, that is impor- 
tant in estimating the security of a protocol. In Ref. T3|, 
they consider a hypothetical situation where Fred can 
freely remove some cases that would lead to the QBER, 
for example, as he does in non-matching cases in the 
quantum Trojan-dark-pony attack above. If Alice and 
Bob have no knowledge on how many times Fred did the 
adversarial removal, then they have to assume the worst 
case that Fred did the removal all of the instances; thus, 
clearly the protocol is not secure. However, if Alice and 
Bob know a bound on the fraction of adversarially re- 
moved event. A, and A is small enough, then the security 
of the protocol can be recovered with a reduced key gen- 
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eration rate depending on the fraction A |T3l : The larger 
the fraction A is, the smaller the key generation rate is. 
Therefore, the problem of estimating security reduces to 
how to estimate the fraction A. 

However, although Eve does not know the identity of 
the quantum carriers that Alice has sent, it is Eve's free- 
dom that she replace Alice's quantum carriers by any 
other quantum carriers. In the quantum Trojan-dark- 
pony attack, for example, it can be that a quantum car- 
rier |0) is replaced by either |0)®^ or if the Z mea- 
surement is chosen. Therefore, we must analyze Bob's 
detector for all different states of N quantum bits. If the 
number of quantum bits TV is unlimited, the analysis is 
impossible. Thus, we assume that the number of quan- 
tum bits is bounded by a certain number M so that 
the analysis can be done. This assumption amounts to 
the assumption that there is a bound on light intensity 
at Bob's site, which can be checked by Bob. With the 
assumption, what we have to do is to analyze all states of 
quantum bits whose number is less than M. Then, by re- 
peated measurements, we estimate the positive-operator 
corresponding to a no-clicking event of Bob's detector in 
each basis 6, where b = z,x. With the positive-operator 
thus obtained, we can calculate the detector efficiency, 
77t(|i/')), for each state \4>) and basis b. 

Let us consider the simplest case where i]b{\ip)) = 1 for 
all states lip) and bases b. In this case, Fred has no chance 
to turn off the switch; thus, the fraction A is zero. Next, 
let us consider a case where ?7fc(|?/')) — Vo for all states 
and bases b. Here, 770 is a real number between and 1. 
Here, the question is how large the fraction A is. In this 
case, it is clear that the fraction A is bounded by 1 — ?7o- 
This corresponds to the simple, but impractical, method 
above where Alice and Bob regard a no-clicking event as 
an 'error event' contributing to the QBER. Thus, we need 
to get a tighter bound for the fraction A. It appears that 
it is hard to do so because there is no way to discriminate 
accidental removals by imperfection from intentional re- 
movals by Fred. However, this is not the case as far as 
the quantum Trojan-dark-pony attack is concerned. This 
can be explained as follows: Let us recall that the basic 
strategy of the quantum Trojan-dark-pony attack is that 
Fred suppresses (enhances) what is advantageous (disad- 
vantageous) for Alice and Bob. More specifically, Fred 
turns off the switch of Bob's detector in non-matching 
cases because only non-matching cases contribute to the 
QBER, and he does nothing in matching cases because 
in matching cases, Eve can obtain information on the key 
of Alice and Bob without contributing to the QBER at 
all. However, in this case where all 77fc(|'0))'s are iden- 
tically 770, it is not that all no-clicking events are ad- 
versarial removals. That is, some removals are rather 
friendly for Alice and Bob: Each state is removed with 
a fixed rate 1 — rjo, regardless of basis b. For example, 
even when \tp) = (n < M) is the input state for 

Bob's detector as in the quantum Trojan-dark-pony at- 
tack, the removal rates for two bases are both 1 — 770 
because 7?(|l)®")z = rydl)®")^ = ryg. Here, removals 



when the detector is in the x basis are adversarial for 
Alice and Bob, but those when the detector is in z basis 
are friendly for Alice and Bob because this is the match- 
ing case advantageous for Eve. The effect of friendly re- 
movals is opposite that of adversarial removals, and here 
the numbers of friendly and adversarial removals are the 
same. Therefore, effectively, the fraction A(|l)®") for the 
state is bounded by |77(|1)®")^ - ?7(|l)®"):r| = re- 

gardless of how those events are removed, accidentally 
or intentionally. However, for other states, for example, 
(|0) -I- lO))**", whether an attack using the state is adver- 
sarial or friendly is not as clear as in the above case. A 
removal of a certain state for a basis is partially adver- 
sarial while the removal of a state for the other basis is 
partially friendly, and similar arguments apply. 

Let us now consider the general case where ribdip)) 
depends on the state \tp). For each state \ip), we have 
a relation that 

Aim <\rjAm-vA\m, w 

as shown above. Then the bound A for all states is simply 
the maximal one among all A(|V'))'s, 

A < Max{A(|?/'))}. (2) 

Our recipe in Eq. ^ is still quite loose bound for A. One 
reason is that it is not that a state that gives maximal 
A is the only one utilized in the actual attack. In other 
words, the situation can be that the state that gives max- 
imal A is not so effective in the eavesdropping. However, 
Eq. ^ is much tighter than the simple method above 
where all no-clicking events are treated as error events. 
It might be that for some detectors, the bound in Eq. 

is too large for a protocol to be secure. However, it 
seems to be possible to design detectors such that the 
no-clicking rate of each state does not depend on the ba- 
sis, in which case the fraction A is zero. In other words, 
if loss of each state is independent of the basis then the 
fraction A is zero. It is notable, however, that even if the 
overall loss is independent of the basis, it might be that 
the the fraction A is not zero because it is an absolute 
value oi riz{\^)) — r]x{\ip)) that bounds the fraction A in 
Eq. ©. 

The bound in Eq. ^ can be easily translated to a 
bound for the quantum Trojan-pony attack by only re- 
placing the detector efficiency 77 with the probability of 
a non-doublc-clicking event. In this case, however, the 
bound in Eq. Q is not that useful because it is not 
easy to make the bound small in most natural designs of 
detectors. 



IV. DISCUSSION AND CONCLUSION 

The results in Ref. i2j] overlap with ours. Let us 
see how they differ. What is the same is that both es- 
cape Alice and Bob's test by keeping the detector from 
clicking in the case of a non-matching basis. However, 
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what we consider is more general that what they consid- 
ered. What they considered is more specific, a detector 
timing mismatch. Even if there is no detector timing 
mismatch, therefore, detectors must be inspected for all 
possible ways in order to get security. Giving security 
proofs for the BB 84 QKD system with no-clicking by co- 
herently dealing with all post-selection effects including 
those in Refs. J/j] and [22, .24, 25] is an open problem. 

In conclusion, we discussed a 'no-clicking' event that 
is harmful for Ahce and Bob in the BB 84 QKD. A 
no-clicking event can give rise to a post-selection ef- 
fect. Specifically, we described an attack, which we term 
the quantum Trojan-dark-pony attack, where no-clicking 
events are utilized in the same way as double-clicking 
events are utilized in the quantum Trojan-pony attack. 
We discussed how to deal with the no-clicking events: 
The formalism of positive-operator-valued-measurement 
(POM) also applies to a no-clicking event, as is known 
|23j . The problem of characterizing a no-clicking event 



reduces to that of identifying a positive-operator corre- 
sponding to a no-clicking event. We discussed how to 
estimate the security of the protocol, against the quan- 
tum Trojan-dark-pony attack with a positive-operator by 
using a formula involving the fraction A of adversarial re- 
movals of events given in Ref. [l7l |. 
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